Fable 5 vs Sonnet 5: why Anthropic's flagship model isn't the best fit for cybersecurity

Anthropic relaunched Fable 5 as its most capable model, and the temptation to use it for everything is immediate. I gave in to that temptation last week, right in the middle of a security analysis task. In three prompts it burned through all my available tokens and, on top of that, wouldn’t let me continue the task. I ended up dropping down to Sonnet 5 halfway through, not because I wanted to, but because I had no other option.

The experiment that didn’t go as planned

The idea was simple: use the most powerful model available to speed up a piece of analysis tied to cybersecurity. Fable 5 started off well, with deep reasoning and solid answers. The problem showed up fast: token consumption was far higher than expected, and before I could finish the task the model simply stopped cold. It wasn’t a quota limit or a config error on my end. It was the model itself refusing to continue.

That’s when I understood something Anthropic’s technical documentation confirms explicitly: Fable 5 runs safety classifiers aimed specifically at biology and cybersecurity content, and the model isn’t intended for those domains.

Why Fable 5 stops cold on cybersecurity topics

Fable 5 is the most capable model Anthropic offers today, built for deep reasoning and long horizon agentic work. But that same power comes with stricter guardrails:

• It runs safety classifiers that target biology and cybersecurity content specifically.
• A request that touches topics considered high risk can end up refused, even when the goal is legitimate (defensive analysis, hardening, reviewing a SIEM rule).
• Extended thinking is always on, which drives token consumption far higher than other models, even on prompts that look simple at first glance.

For a cybersecurity analyst, that combination is exactly the opposite of what’s needed: predictability and continuity on security tasks, not a model that can stop the task halfway through based on its own risk judgment.

Sonnet 5, the more practical choice

Sonnet 5 doesn’t have the same raw power as Fable 5, but for real security work it has concrete advantages:

• It costs $3 per million input tokens and $15 per million output tokens (with promotional pricing of $2 and $10 through the end of August 2026), against $10 and $50 for Fable 5.
• It also has safeguards for high risk content, but it’s built as the daily driver model for code and agentic work, not as a model restricted by default on cybersecurity topics.
• It keeps the same 1 million token context window as Fable 5, without the extra cost of always on thinking.

In practice, I finished my analysis on Sonnet 5 without a hitch, at a much lower cost, and without the model refusing to continue.

The practical rule

Don’t reach for the most expensive, newest model just because it’s the newest. For cybersecurity tasks (incident analysis, hardening, detection review, security automation) Sonnet 5 is today the more predictable and cheaper option. Save Fable 5 for general purpose reasoning where the topic doesn’t touch cybersecurity or biology, because that’s where it actually shines.

Did you also hit this wall with Fable 5, or did you have better luck? I’d like to compare notes, reach out on LinkedIn.

Sources: Anthropic’s official model documentation on pricing, context window, and safety classifiers for Fable 5 and Sonnet 5.